CVE-2020-24341

2020-12-1122:55:33

mitre

www.cve.org

picotcp

picotcp-ng

tcp input data

data processing function

length validation

tcp packets

out-of-bounds read

data segment

denial-of-service

information leak

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

59.5%

JSON

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.